Split npm-publish out of verbump

It’s useful to keep them as separate scripts for the moment so that we
can inspect the system in between each step.
Readme update